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INTEREST OF AMICI CURIAE 1 

The American Civil Liberties Union (“ACLU”) is a nationwide, non-profit, 
non-partisan public interest organization dedicated to defending civil rights and 
civil liberties. The ACLUs of New Hampshire, Maine, Massachusetts, Puerto Rico, 
and Rhode Island are the affiliates of the national ACLU within the jurisdiction of 
the First Circuit. The protection of privacy as guaranteed by the Fourth 
Amendment is of special concern to each organization. The ACLU has been at the 
forefront of numerous state and federal cases addressing the right of privacy, 
including as counsel for petitioner in Carpenter v. United States , 138 S. Ct. 2206 
(2018), and counsel for intervenors in Oregon Prescription Drug Monitoring 
Program v. United States Drug Enforcement Administration (Or. PDMP), 998 F. 
Supp. 2d 957 (D. Or. 2014), rev’d on standing grounds , 860 F.3d 1228 (9th Cir. 
2017), and United States Department of Justice v. Utah Department of Commerce, 
No. 16-cv-611, 2017 WL 3189868 (D. Utah July 27, 2017). The ACLU and its 
affiliates have also been at the forefront of legislative efforts to protect sensitive 
medical records in state prescription drug monitoring program (“PDMP”) 
databases against warrantless search by law enforcement. Each jurisdiction within 

1 Pursuant to Rule 29(a)(2), counsel for amici curiae certifies that all parties have 
consented to the filing of this brief. Pursuant to Rule 29(a)(4)(E), counsel for amici 
curiae states that no counsel for a party authored this brief in whole or in part, and 
no person other than amici curiae, their members, or their counsel made a 
monetary contribution to its preparation or submission. 
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the First Circuit maintains a PDMP, the privacy protections for which will be 
affected by the outcome of this case. 

The New Hampshire Medical Society (“NHMS”), founded in 1791, is 
dedicated and committed to advocating for patients, physicians, and the medical 
profession, as well as health-related rights, responsibilities and issues for the 
betterment of public health in the Granite State. The NHMS was highly involved in 
the development and implementation of the legislation and regulations for New 
Hampshire’s PDMP, including efforts to protect sensitive medical records from 
warrantless search by law enforcement. 

SUMMARY OF ARGUMENT 

The prescription records at issue in this case reveal intimate, private, and 
potentially stigmatizing details about patients’ health, including details of those 
patients’ underlying medical conditions. For that reason, as with other medical 
records, people have a reasonable expectation of privacy in them. As the Supreme 
Court explained in Carpenter v. United States, when law enforcement seeks 
records from a third party in which the subject of the investigation has a reasonable 
expectation of privacy, use of an administrative subpoena is unreasonable under 
the Fourth Amendment, and a warrant is required instead. Such is the case here. 

That expectation of privacy is not diminished because authorities are 
permitted to conduct administrative inspections of individual pharmacies pursuant 
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to the closely regulated industry exception to the warrant requirement. Rather than 
inspecting particular pharmacies for regulatory compliance, the Drug Enforcement 
Administration (“DEA”) in this case seeks to conduct a criminal investigative 
search of a state agency’s secure database containing confidential records from 
every pharmacy in the state. Such a search is untethered from the rationales behind 
any exception to the warrant requirement. 

Finally, Appellant Michelle Ricco Jonas (“Jonas”) properly raises Fourth 
Amendment arguments in this case. As custodian of the PDMP and recipient of the 
DEA’s subpoena, she is entitled to argue in her own right that the subpoena is 
unreasonable under the Fourth Amendment. She is also entitled to assert the Fourth 
Amendment rights of individuals with records in the PDMP, because she has a 
close relationship with them and they are prevented from doing so themselves by 
lack of notice of the subpoena. 

ARGUMENT 

I. People Have a Reasonable Expectation of Privacy in Their Sensitive 
Medical Information Held in Prescription Drug Monitoring Program 
Databases. 

Where an individual has a reasonable expectation of privacy in an item or 
location to be searched, the search is “‘per se unreasonable under the Fourth 
Amendment’” unless conducted pursuant to a judicial warrant. Arizona v. Gant, 

556 U.S. 332, 338 (2009) (quoting Katz v. United States , 389 U.S. 347, 357 
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(1967)). Only if there is no reasonable expectation of privacy, or if one of the “few 
specifically established and well-delineated exceptions” to the warrant requirement 
applies, may government officials conduct a warrantless search. Id. (quotation 
marks omitted). As the Supreme Court recently made clear, the warrant 
requirement applies even when the government seeks to compel a third party to 
produce records in which an individual has a reasonable expectation of privacy. 
Carpenter, 138 S. Ct. at 2221-22. In that circumstance, the use of an 
administrative subpoena is unreasonable under the Fourth Amendment, and a 
warrant is required instead. Id. Indeed, long before Carpenter, this Court 
recognized that a subpoena seeking personal records rather than corporate 
documents, as is the case here, raises special concerns. United States v. Sturm, 
Ruger, & Co., 84 F.3d 1, 4 n.l (1st Cir. 1996) (citing In re Gimbel, 77 F.3d 593, 
596-600 (2d Cir. 1996)). 

In Carpenter, the Supreme Court made clear that the mere fact that records 
are held by a third party does not vitiate an individual’s reasonable expectation of 
privacy under the Fourth Amendment. 138 S. Ct. at 2220. Instead, the Court 
explained, the cases on which the third-party doctrine is based— United States v. 
Miller, 425 U.S. 435 (1976), and Smith v. Maryland, 442 U.S. 735 (1979)—require 
a dual inquiry into “the nature of the particular documents sought” and whether 
they were “voluntarily] expos[ed].” 138 S. Ct. at 2219-20. 
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Here, both factors favor the conclusion that there is a reasonable expectation 
of privacy in the PDMP records sought by the DEA, and thus that the third-party 
doctrine does not apply. Indeed, even before Carpenter, the District of Oregon 
correctly applied and distinguished Miller and Smith, concluding that the 
sensitivity of PDMP records and the lack of voluntariness in their creation and 
conveyance mean that they are protected by the Fourth Amendment. Or. PDMP, 
998 F. Supp. 2d at 963-67. After Carpenter, it is all the more clear that that 
outcome is correct. See Jennifer D. Oliva, Prescription Drug Policing: The Right 
to Protected Health Information Privacy Pre- and FW-Carpenter, 69 Duke F.J. _ 
(forthcoming 2020), available at https://ssrn.com/abstract=3225000. 

A. The sensitive nature of the private medical information contained 
in the New Hampshire PDMP creates a reasonable expectation of 
privacy. 

The DEA’s warrantless request in this case impinges on reasonable 
expectations of privacy because of “the particularly private nature of the medical 
information at issue,” Or. PDMP, 860 F. 3d at 1235 (9th Cir. 2017), in state PDMP 
databases. 

1. Prescription records reveal private and sensitive 
information. 

As the Supreme Court has explained, “[t]he reasonable expectation of 
privacy enjoyed by the typical patient undergoing diagnostic tests in a hospital is 
that the results of those tests will not be shared with nonmedical personnel without 
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her consent.” Ferguson v. City of Charleston , 532 U.S. 67, 78 (2001). That is so 
notwithstanding that the records are held by a third party—the hospital —rather 
than by a patient themselves. Other courts have likewise held that there is a 
reasonable expectation of privacy in medical records in the custody of third parties. 
See, e.g., Tucson Woman’s Clinic v. Eden, 379 F.3d 531, 550 (9th Cir. 2004) 
(requiring warrant for search of medical records in abortion clinic because “all 
provision of medical services in private physicians’ offices carries with it a high 
expectation of privacy for both physician and patient”); Doe v. Broderick, 225 F.3d 
440, 450 (4th Cir. 2000) (“[A] patient’s expectation of privacy ... in his treatment 
records and files maintained by a substance abuse treatment center is one that 
society is willing to recognize as objectively reasonable.”); State v. Skinner, 10 So. 
3d 1212, 1218 (La. 2009) (“[W]e find that the right to privacy in one’s medical and 
prescription records is an expectation of privacy that society is prepared to 
recognize as reasonable.”). The prescription records in this case entail the same 
privacy concerns. 2 


2 

The federal government is wrong in suggesting that the Supreme Court settled the 
Fourth Amendment question here in Whalen v. Roe, 429 U.S. 589 (1977). See 
Appellant’s App. 136. In Whalen, the Court held that New York’s collection of 
prescription records in an early computerized database did not violate patients’ and 
doctors’ right to informational privacy under the Due Process Clause of the 
Fourteenth Amendment. 429 U.S. at 600. The Court distinguished situations—not 
presented by that case—“involving] affirmative, unannounced, narrowly focused 
intrusions into individual privacy during the course of criminal investigations,” 
where the Fourth Amendment would apply. Id. at 604 n.32. The DEA’s 

6 
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Drugs listed as controlled substances and tracked by the PDMP include a 
number of frequently prescribed medications used to treat a wide range of serious 
medical conditions, including anxiety disorders, panic disorders, post-traumatic 
stress disorder, weight loss associated with AIDS, nausea and weight loss in cancer 
patients undergoing chemotherapy, alcohol addiction withdrawal symptoms, opiate 
addiction, testosterone deficiency, gender identity disorder/gender dysphoria, 
chronic and acute pain, seizure disorders, narcolepsy, insomnia, and attention 
deficit hyperactivity disorder. (An addendum to this brief lists selected medications 
tracked by the PDMP that are used to treat these medical conditions.) 

An individual’s prescription records in the PDMP can reveal a great deal of 

private medical information beyond just the medication prescribed. Because many 

of these drugs are approved only for treatment of specific diseases or disorders, 

“[ijnformation contained in prescription records . . . may reveal other facts about 

what illnesses a person has.” Douglas v. Dobbs, 419 F.3d 1097, 1102 (10th Cir. 

2005); accord Doe v. Se. Pa. Transp. Auth., 72 F.3d 1133, 1138 (3d Cir. 1995) (“It 

is now possible from looking at an individual’s prescription records to determine 

that person’s illnesses, or even to ascertain such private facts as whether a woman 

is attempting to conceive a child through the use of fertility drugs.”). A patient’s 

prescription history can reveal her physician’s confidential medical advice, her 

investigative request to the PDMP presents precisely the Fourth Amendment 
question left open by Whalen. 
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chosen course of treatment, her diagnosis, and even the stage or severity of her 
disorder or disease. Thus, this Court’s observation that people “have significant 
privacy interests in their medical records, which we have described as ‘highly 
personal’ and ‘intimate in nature,”’ Eil v. U.S. Drug Enf’t Admin., 878 F.3d 392, 
400 (1st Cir. 2017), applies with full force to the prescription records at issue here. 

2. Society recognizes the expectation of privacy in prescription 
records as reasonable. 

In recognition of the sensitivity of this information, the New Hampshire 
legislature erected strong protections for the confidentiality and security of the 
prescription records reported by health care providers and stored in the PDMP. 
Physicians and pharmacists are permitted to access the database only for the 
limited purposes of “providing medical or pharmaceutical care to a specific 
patient,” “reviewing information regarding prescriptions issued or dispensed by the 
requester,” or “investigating the death of an individual.” N.H. Rev. Stat. Ann. 

§ 318-B:35(I). Unauthorized use of or access to the database subjects a person to 
felony prosecution or discipline by a regulatory board. Id. § 318-B:36(IV-VII). 

The records are also exempted from disclosure under the state public records law, 
and are “not subject to discovery, subpoena, or other means of legal compulsion 
for release.” Id. § 318-B:34(I). Central to this case, law enforcement agents can 
access data in the PDMP only with a search warrant or other court order based on 
probable cause. Id. § 318-B:35(I)(b)(3); N.H. Code Admin. R. Ph 1505.03. 
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These protections are part of an extensive historical tradition, as “[m jedical 
records, of which prescription records form a not insignificant part, have long been 
treated with confidentiality.” Or. PDMP, 998 F. Supp. 2d at 964. The Oath of 
Hippocrates, originating in the fourth century B.C.E., required physicians to 
maintain patient secrets. Bernard Friedland, Physician-Patient Confidentiality , 15 
J. Legal Med. 249, 256 (1994). In American medical practice, a requirement to 
preserve the confidentiality of patient health information was included in the 
earliest codes of ethics of American medical societies in the 1820s and 1830s, the 
first Code of Medical Ethics of the American Medical Association in 1847, and 
every subsequent edition of that code, in the ethical codes of other health 
professionals, including pharmacists, and in the numerous state statutes 
recognizing the doctor-patient privilege. See generally Robert Baker, Before 
Bioethics: A History of American Medical Ethics from the Colonial Period to the 
Bioethics Revolution (2013); Am. Med. Ass’n, Code of Medical Ethics Opinion 
3.2.1: Confidentiality, https://www.ama-assn.org/delivering-care/ethics/ 
confidentiality; Am. Pharmacists Ass’n, Code of Ethics § II, 
https://www.pharmacist.com/code-ethics; N.H. Rev. Stat. Ann. § 329:26 
(physician-patient privilege). Today, virtually all patients (97.2%) believe that 
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health care providers have a “legal and ethical responsibility to protect patients’ 

•2 

medical records.” 

The strong and enduring guarantees of the confidentiality of patients’ 
medical information are 

essential to the effective functioning of the health and public health 
systems. Patients are less likely to divulge sensitive information to 
health professionals if they are not assured that their confidences will 
be respected. The consequence of incomplete information is that 
patients may not receive adequate diagnosis and treatment of 
important health conditions. 

Lawrence O. Gostin, Health Information Privacy, 80 Cornell L. Rev. 451, 490-91 
(1995). The consequences of law enforcement gaining easy access to medical 
records are especially harmful. As one court has explained, “[permitting the State 
unlimited access to medical records for the purposes of prosecuting the patient 
would have the highly oppressive effect of chilling the decision of any and all 
[persons] to seek medical treatment.” King v. State, 535 S.E.2d 492, 496 (Ga. 
2000). The Supreme Court has similarly recognized that facilitating warrantless 
law enforcement access to patients’ medical information “may have adverse 
consequences because it may deter patients from receiving needed medical care.” 
Ferguson, 532 U.S. at 78 n.14 (citing Whalen, 429 U.S. at 599-600). What is true 


2 

New London Consulting & FairWaming, How Privacy Considerations Drive 
Patient Decisions and Impact Patient Care Outcomes 10 (Sept. 13, 2011), 
http ://www.fairwaming.com/whitepapers/2011 -09-WP-US-P ATIENT- 
SURVEY.pdf. 
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of medical privacy more broadly is also true of PDMPs: prescription monitoring 
“efforts that fail to adequately safeguard patient data do much more than harm 
individual rights; by undermining patient trust and creating a system of perverse 
incentives, they can push patients away from seeking appropriate, timely help.” 
Leo Beletsky, Deploying Prescription Drug Monitoring to Address the Overdose 
Crisis: Ideology Meets Reality, 15 Ind. Health L. Rev. 139, 142 (2018). 

B. Records held in the PDMP are not voluntarily conveyed by 
patients. 

“Neither does the second rationale underlying the third-party doctrine— 
voluntary exposure—hold up when it comes to” records in the PDMP. Carpenter, 
138 S. Ct. at 2220. Unlike the cancelled checks at issue in Miller and the dialed 
telephone numbers in Smith, the prescription records contained in the PDMP are 
not voluntarily conveyed. The decision to visit a physician and pharmacist to 
obtain urgent medical treatment is not in any meaningful sense voluntary. 
Obtaining medical care for a serious condition such as acute pain, seizure 
disorders, panic or anxiety disorders, AIDS, or opioid addiction is a course of 
action dictated by one’s physical and psychological ailments. Opting to forgo care 
can leave a person debilitated or even dead. As one court has explained, “the rule 
in Miller pertains to objects or information voluntarily turned over to third parties. 
A decision to use a bank may be voluntary. A decision to use a hospital for 
emergency care is not.” Thurman v. State, 861 S.W.2d 96, 98 (Tex. App. 1993) 
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(citation omitted). Moreover, once a person has sought care, New Hampshire law 
requires pharmacists to report all prescriptions for schedule II-IV drugs to the 
PDMP. N.H. Rev. Stat. Ann. § 318-B:33(III). Thus, apart from foregoing care, 
“there is no way to avoid leaving behind a trail of [medical] data.” Carpenter , 138 
S. Ct. at 2220. “As a result, in no meaningful sense does the [patient] voluntarily 
‘assume[ ] the risk’ of turning over” this information. Id. (second alteration in 
original). 

C. PDMP records share important traits with the location data in 
Carpenter , and thus deserve protection. 

In Carpenter, the Supreme Court held that the government conducts a 
Fourth Amendment search when it acquires a person’s cell site location 
information (“CSLI”) from their cellular service provider. 4 138 S. Ct. at 2220. 
While recognizing that Miller and Smith will continue to permit warrantless 
requests for certain kinds of data, like the bank records and dialed phone numbers 
at issue in those cases, the Court “decline[d] to extend” the third-party doctrine to 
the digital agglomerations of sensitive location data held by wireless carriers today. 
Id. In reaching this conclusion, the Court provided several factors that distinguish 
CSLI from more rudimentary forms of third-party-held data. Id. at 2217-20, 2223; 
see also Paul Ohm, The Many Revolutions of Carpenter , 32 Harv. J.L. & Tech._ 

4 The Court only addressed searches of seven days or more of data, and reserved 
decision on lesser durations of CSLI. 138 S. Ct. at 2217 n.3. Here, the DEA seeks 
more than two years ’ worth of PDMP records. Appellant’s App. 24. 
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(forthcoming 2019), available at https://osf.io/preprints/lawarxiv/bsedj (discussing 
factors). Those factors apply with full force to the records in the PDMP. 

1. “ Deeply revealing nature, ” 138 S. Ct. at 2223: Like CSLI, PDMP 
records “provide^ an intimate window into a person’s life.” Id. at 2217. Knowing 
what medications a person takes, and thus what medical conditions they have, is 
tremendously revealing. See supra Part I.A. That is why people consider 
information about the “state of their health and the medicines they take” to be 
among the most private information about them, deeming it more sensitive even 
than the “details of [their] physical location over a period of time” at issue in 
Carpenter. Mary Madden, Americans Consider Certain Kinds of Data to be More 
Sensitive than Others, Pew Research Center (2014), https://www.pewinternet.org/ 
2014/11/12/americans-consider-certain-kinds-of-data-to-be-more-sensitive-than- 
others. 

2. “ Depth, breadth, and comprehensive reach, ” 138 S. Ct. at 2223: The 
Supreme Court observed that CSLI differs from other more limited kinds of 
location data because it constitutes “an all-encompassing record of the holder’s 
whereabouts,” id. at 2217, because it is “continually logged for all of the 400 
million devices in the United States—not just those belonging to persons who 
might happen to come under investigation,” id. at 2218, and because the data is 
retained—and therefore accessible to police—for years, id. Likewise, the PDMP 


13 




Case: 19-1243 Document: 00117444283 Page: 23 Date Filed: 05/29/2019 Entry ID: 6256847 


contains not just a smattering of recent prescriptions filled by a particular 
pharmacist, but an “all-encompassing record,” id. at 2217, of every qualifying 
controlled substance prescription filled by every pharmacist in New Hampshire for 
every New Hampshire resident, which is retained in the system for three years. 
N.H. Rev. Stat. Ann. § 318-B:32(III). “[Tjhis newfound tracking capacity runs 
against everyone,” Carpenter 138 S. Ct. at 2218, and provides a window into 
people’s most closely held “privacies of life,” id. at 2214 (citation omitted). 

3. “ Inescapable and automatic nature of its collection ,” id. at 2223: The 
Supreme Court explained that cell phone location information is not “truly ‘shared’ 
as one normally understands the term,” both because carrying a cell phone is 
“indispensable to participation in modern society,” and because once a person has 
an operational cell phone, it automatically and inescapably generates location data. 
Id. at 2220. Likewise, the decision to visit a physician and pharmacist to obtain 
necessary medical care is not in any meaningful sense voluntary, and once a 
patient has obtained a prescription from their doctor and filled it with their 
pharmacist, the pharmacist conveys the prescription to the PDMP “by dint of its 
operation,” id., with no volition or even knowledge of the patient. See supra Part 
I.B. Unlike the more quotidian internet protocol address information at issue in this 
Court’s recent decision in United States v. Hood, which even the defendant did 
“not dispute that he voluntarily disclosed,” 920 F.3d 87, 91 (1st Cir. 2019), the 
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collection of prescription records in the PDMP is not in any meaningful sense 
“voluntary[ily] expos[ed],” Carpenter , 138 S. Ct. at 2220. 

4. “ Remarkably easy, cheap, and efficient compared to traditional 
investigative tools ,” id. at 2218: The central lesson of Carpenter is that courts 
cannot “mechanically apply[]” the third-party doctrine to newer forms of digital- 
age records that provide the government with powers of investigation that would 
have been unimaginable in past eras. Id. at 2214, 2219. Thus, CSLI requires Fourth 
Amendment protection because, “[pjrior to the digital age, law enforcement might 
have pursued a suspect for a brief stretch, but doing so ‘for any extended period of 
time was difficult and costly and therefore rarely undertaken.’” Id. at 2217 (citation 
omitted). Today, by contrast, “[w]ith just the click of a button, the Government can 
access each carrier’s deep repository of historical location information at 
practically no expense.” Id. at 2218. 

Similarly, prior to computerized PDMPs, investigators could have sought 
prescription records from individual pharmacies. Only in the rarest of 
investigations, however, could police have canvassed every pharmacy in the state 
and collected a comprehensive set of its prescription records. Never could 
investigators have done so instantaneously, “with just the click of a button.” Id. 
Thus, in order to “assure [ ] preservation of that degree of privacy against 
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government that existed when the Fourth Amendment was adopted,” id. at 2214 
(alteration in original), a warrant is required. 

II. The Closely Regulated Industry Exception to the Warrant Requirement 

Does Not Apply. 

Citing this Court’s opinion in United States v. Gonsalves, 435 F.3d 64 (1st 
Cir. 2006), the federal government argued below that there is a reduced 
expectation of privacy in PDMP records because pharmacies are a closely 
regulated industry. Appellant’s App. 137-38. However, neither Gonsalves nor the 
logic of the closely regulated industry exception to the warrant requirement bear 
the weight the federal government places on them. 

Under the closely regulated industry exception, warrantless administrative 
inspections are permissible only when they are “necessary” to further a substantial 
government interest. Gonsalves, 435 F.3d at 67. That necessity is satisfied by “the 
need for random and surprise inspections,” id. at 68, in order to avoid potential 
disappearance of evidence during the delay required to obtain a warrant. See New 
York v. Burger, 482 U.S. 691, 710 (1987) (“Because stolen cars and parts often 
pass quickly through an automobile junkyard, ‘frequent’ and ‘unannounced’ 
inspections are necessary in order to detect them.”). But there is no such risk of 
disappearance or alteration of evidence here, as the records sought are held 
securely in a state database out of reach of any meddling hands. Warrantless access 
is simply not necessary to further the government’s investigative interests. 
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Nor does the ability of authorities to conduct administrative inspections of 
individual pharmacies or other drug dispensaries to check for regulatory 
compliance reduce the expectation of privacy in sensitive prescription records in 
the PDMP, particularly as against a criminal investigative search of an individual 
patient’s records. In Gonsalves, this Court upheld a Rhode Island law permitting 
warrantless “administrative searches of‘establishments’ where drugs are 
manufactured and stored.” 435 F.3d at 67. It did so on the basis that “drugs are 
heavily regulated in storage and dispensation and have been for many years.” Id. 
This Court took pains, however, to emphasize the narrowness of its holding: 
“Whether the practice of medicine in general meets this test is a different question 
that we need not decide. Nor are we concerned on this appeal with patient records; 
[the] search and seizure was solely directed to misbranded and adulterated drugs 
held at large in [the physician’s] office.” 5 Id. (citation omitted). Thus, “[g]iven the 
variations in fact patterns and the sensitivity of the subject area,” the Court found 
“good reason to keep [its] focus narrow.” Id. As the Supreme Court has explained, 
the reasonableness of an administrative search is determined “by balancing the 
need to search against the invasion which the search entails.” Camara v. Man. 
Court, 387 U.S. 523, 537 (1967). As predicted by this Court, the invasion into 

5 Investigators were concerned with reports of a physician dispensing diluted 
vaccines, and so conducted an inspection of the physician’s office to look for 
“misbranded or adulterated drugs.” Id. at 66. 
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individual privacy here is significant, and no exception to the warrant requirement 
applies. See supra Part I.A. 

The federal government cites the state statute governing administrative 
inspections of pharmacies as diminishing New Hampshire patients’ expectations of 
privacy in PDMP records. Appellant’s App. 137 (citing N.H. Rev. Stat. Ann. § 

318-B: 12). But similar to the law at issue in Gonsalves, that statute permits 
administrative inspections of a pharmacy’s records to determine whether “licensed 
pharmacies and pharmacists-in-charge comply ‘with all local, state, and federal 
pharmacy and drug laws.’” In re Morgan, 742 A.2d 101, 105 (N.H. 1999) (quoting 
N.H. Rev. Stat. Ann. § 318:1). The existence of an exception to the warrant 
requirement as to certain records held by one class of regulated businesses does not 
justify warrantless searches of any and all similar records, no matter where they are 
obtained. As the Supreme Court has put it, “[t]he fact that equivalent information 
could sometimes be obtained by other means does not make lawful the use of 
means that violate the Fourth Amendment.” Kyllo v. United States, 533 U.S. 27, 35 
n.2 (2001). Whatever the closely regulated industry doctrine might say about 
administrative inspections of pharmacies’ books, the DEA does not seek to inspect 
pharmacies’ books in this case. Rather, it seeks to search the records of a state 
agency. Amici are aware of no cases applying the closely regulated industry 
exception to a warrantless search of a state agency’s records, much less an agency 
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database of private medical information from many thousands of people across the 
state. The cases address searches of discrete commercial enterprises, and so do not 
govern here. 

III. Jonas May Argue that Under the Fourth Amendment the DEA Must 

Obtain a Warrant before Demanding PDMP Records. 

The DEA argued below that Jonas may not assert the Fourth Amendment 
privacy interests of the individuals whose information the agency seeks from the 
PDMP in arguing that a warrant is required to access the database. That argument 
is incorrect on two counts. 

A. Jonas may vindicate her own Fourth Amendment interests. 

First, as the recipient of the subpoena and custodian of the PDMP records, 
Jonas is entitled to argue that the subpoena is unreasonable under the Fourth 
Amendment. See, e.g., Sturm, Ruger, & Co., 84 F.3d at 3 (“the Fourth Amendment 
is available to the challenger as a defense against enforcement of the subpoena”). It 
is true that typically the reasonableness of a subpoena is challenged on the ground 
that it is overly burdensome or seeks information not relevant to the investigation. 
Id. at 4. But in Carpenter, the Supreme Court explained that a subpoena is also 
unreasonable when it seeks a type of records in which people have “a legitimate 
privacy interest,” 138 S. Ct. at 2222. There is no sound reason why Jonas should be 
permitted to make the former argument but not the latter. 
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Jonas is fully capable of making that argument and explaining to this Court 
why “society is prepared to recognize as reasonable,” id. at 2213, the expectation 
of privacy in PDMP records. Indeed, every New Hampshire resident with 
prescription records in the PDMP is similarly situated for purposes of this case, as 
their records are protected equally by the State’s statutory privacy and 
confidentiality protections. 6 As the recipient of the subpoena and custodian of the 
PDMP, Jonas is entitled to vindicate her own (and the State’s) Fourth Amendment 
rights by arguing that the DEA’s subpoena is a per se unreasonable method of 
requesting PDMP records, and that a warrant is required instead. 

B. Jonas may raise New Hampshire patients’ Fourth Amendment 
interests. 

Second, under the doctrine of third-party standing, Jonas may properly raise 

n 

the privacy interests of individuals whose records reside in the PDMP. The 


6 In Carpenter , the Court made no inquiry into Mr. Carpenter’s actual or subjective 
belief about whether the records should be private, instead focusing on the nature 
of the records in general and all they can reveal. 138 S. Ct. at 2217-19. Moreover, 
this case is not one where disputed facts about the subjective expectation of 
privacy of a particular suspect might matter, and thus where the suspect must 
proffer such facts. See, e.g., Minnesota v. Carter, 525 U.S. 83, 90-91 (1998). 

n 

Amici argue here that, as custodian of the PDMP records, Jonas may challenge 
the constitutionality of the DEA’s subpoena, separate and apart from any 
entitlement of the State invoke parens patriae standing. See Appellant’s Br. 42^14. 
Thus, even if the federal government is right that “[t]he action here ... is not a suit 
against the State,” Appellant’s App. 130, and thus that the parens patriae doctrine 
cannot apply, id. at 135 n.l, Jonas may still properly challenge the constitutionality 
of the subpoena under the Fourth Amendment. 
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general rule against third-party standing is a prudential one, which “should not be 
applied where its underlying justifications are absent.” Singleton v. Wulff, 428 U.S. 
106, 114 (1976). In cases like this one, the policies underlying that “rule of 
practice” are “outweighed by the need to protect. . . fundamental rights” when “it 
would be difficult if not impossible for the persons whose rights are asserted to 
present their grievance before any court.” Barrows v. Jackson, 346 U.S. 249, 257 
(1953). 

As the PDMP’s custodian, Jonas plainly overcomes the prudential limits on 
third-party standing because (1) she has a close relationship with the individuals 
whose records the PDMP holds in trust, and (2) those individuals are unable to 
protect their own interests independently. See Mills v. United States, 742 F.3d 400, 
407 (9th Cir. 2014) (citing Kowalski v. Tesmer, 543 U.S. 125, 130 (2004)); see 
also Powers v. Ohio, 499 U.S. 400, 411 (1991) (articulating test for third-party 
standing). 

As to the first factor, like other custodians of medical records bound by 
duties of confidentiality, Jonas has a close relationship with the people whose 
records are collected and safeguarded in the PDMP. See, e.g., In re Search 
Warrant, 810 F.2d 67, 70-71 (3d Cir. 1987) (third-party standing for physician to 
protect medical records on behalf of patients); United States v. Westinghouse Elec. 
Corp., 638 F.2d 570, 574 (3d Cir. 1980) (employer to protect medical records on 
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behalf of employees); see also N.H. Rev. Stat. Ann. § 318-B:34(II) (“The board [of 
pharmacy] shall establish and maintain procedures to ensure the privacy and 
confidentiality of patients and patient information.”); N.H. Code Admin. R. Ph 
1505.01-05 (privacy and confidentiality regulations). That is plainly the kind of 
relationship that suffices to overcome the general rule against third-party standing. 
See, e.g., Powers, 499 U.S. at 413-14 (criminal defendant on behalf of jurors); 
Barrows, 346 U.S. at 255-60 (white land-seller on behalf of prospective Black 
buyers); In re Directives Pursuant to Sec. 105B of Foreign Intelligence 
Surveillance Act, 551 F.3d 1004, 1008-09 (F.I.S.A. Ct. Rev. 2008) (internet 
service provider on behalf of customers); Rothner v. City of Chicago, 929 F.2d 
297, 300-01 (7th Cir. 1991) (video game distributer on behalf of minor customers). 

And as to the second—and “more important,” Eisenstadt v. Baird, 405 U.S. 
438, 445 (1972)—third-party standing factor, the individuals whose records are the 
subject of the subpoena are hindered from advancing their own rights by the lack 
of notice of the subpoena. Westinghouse Elec. Corp., 638 F.2d at 574 (“As a 
practical matter, the absence of any notice to the employees of the subpoena means 
that no person other than Westinghouse would be likely to raise the privacy claim. 
Indeed, this claim may be effectively lost if we do not hear it now.”); see also 
Appellant’s App. 24 (DEA subpoena requesting recipient to “not disclose the 
existence of this request or investigation for an indefinite time period”). 
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The DEA cannot seriously dispute this analysis. Instead, it appears to argue 
that third-party standing doctrine simply does not apply when it comes to Fourth 
Amendment rights at all because “Fourth Amendment rights are personal to each 
person and may not be asserted vicariously.” Appellant’s App. 134 (quotation 
marks and alterations omitted). But there is no such Fourth Amendment exception, 
and the DEA’s argument both selectively misreads Supreme Court precedent and is 
illogical. 

First, the DEA’s main support below, see id., for its supposed special Fourth 
Amendment exception to the third-party standing doctrine was California Bankers 
Association v. Shultz, 416 U.S. 21, 69 (1974), but that case establishes no such 
rule. In Shultz, a banking association sought to challenge a bank-secrecy regulation 
that affected account holders who engaged in transactions larger than $10,000. Id. 
at 58. The association challenged the regulation by arguing that it violated the 
Fourth Amendment rights of depositors to the association’s banks. Id. at 67. Far 
from holding that the association could never raise such Fourth Amendment claim, 
the Court simply stated that the association lacked standing because it did “not 
show that [the depositors’] transactions [were] required to be reported” pursuant to 
the regulation. Id. at 68. In other words, the association had not pled (and the Court 
“simply [could not] assume”) that any individual depositor to any of the 
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association’s banks “ha[d] engaged or will engage in a transaction involving more 
than $10,000 in currency.” Id. & 

Second, some courts have erroneously pointed to cases applying the Fourth 
Amendment’s exclusionary rule as establishing a general rule that “a plaintiff may 
not assert the Fourth Amendment rights of another person.” Microsoft Corp. v. 
DOJ, 233 F. Supp. 3d 887, 913 (W.D. Wash. 2017) (citing Rakas v. Illinois , 439 
U.S. 128 (1978), and Alderman v. United States , 394 U.S. 165 (1969)). To be sure, 
third parties may not invoke the exclusionary rule to suppress evidence that was 
obtained in violation of the privacy interests of others. See, e.g.,Nat’l Cottonseed 
Prods. Ass ’n v. Brock , 825 F.2d 482, 491 (D.C. Cir. 1987). But that limitation is 
tied to the particular remedy of evidentiary suppression. See, e.g., United States v. 
Salvucci, 448 U.S. 83, 86-89 (1980). The supposed principal authority for that 
proposition —Rakas —explicitly (and solely) concerned the costs and benefits of 
the exclusionary rule. See 439 U.S. at 137-38 (“Since our cases generally have 
held that one whose Fourth Amendment rights are violated may successfully 
suppress evidence obtained in the course of an illegal search and seizure, 

o 

The Court further explained that “the Fourth Amendment claims of the 
depositors] may not be considered on the record before us,” and that the 
association could not “vicariously assert such Fourth Amendment claims on behalf 
of bank customers in general.” Id. at 69. The emphasis in that sentence is on “in 
general ,” rather than on “vicariously.” The Court was merely explaining that it 
would not address an insufficiently pled Fourth Amendment claim—not that the 
association could never bring such a claim. 
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misgivings as to the benefit of enlarging the class of persons who may invoke that 
rule are properly considered when deciding whether to expand standing to assert 
Fourth Amendment violations.”). The same is true of Alderman. See 394 U.S. at 
174 (“There is no necessity to exclude evidence against one defendant in order to 
protect the rights of another. No rights of the victim of an illegal search are at stake 
when the evidence is offered against some other party.”). It is little surprise, then, 
that when this Court has remarked on the failure of “vicarious” claims of Fourth 
Amendment rights, it has done so with reliance on exclusionary-rule cases. See, 
e.g.. United States v. Torres, 162 F.3d 6, 10 (1st Cir. 1998) (stating that “Fourth 
Amendment rights are personal to each defendant and may not be asserted 
vicariously” and citing only exclusionary-rule cases (emphasis added)). Moreover, 
the fact that exclusionary-rule cases fall outside the general rule for third-party 
standing makes good sense. In those cases, a litigant is invoking the rights of 
another in order to protect the rights of himself and only himself —and it is not 
difficult to understand why courts would be reluctant to allow such claims. 9 But in 
cases like this one (as well as the litany of other third-party standing cases 
reviewed above), a litigant is invoking the rights of another who cannot do so 

9 For example, in Rakas, two defendants sought to exclude evidence found in the 
locked glove compartment of another person’s car. 439 U.S. at 130-31. And in 
Alderman, two defendants sought to suppress evidence obtained through 
eavesdropping in another person’s place of business. 394 U.S. at 167. 
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himself in order to protect the rights of that other person. That is classic third-party 
standing territory. 

Third, and relatedly, there is no reason to have a special rule of third-party 
standing for Fourth Amendment claims writ large. The decision in In re Directives 
makes clear that there is no blanket rule prohibiting “vicarious” Fourth 
Amendment arguments. In a case closely analogous to this one, the government 
issued a national-security surveillance demand on Yahoo!. See 551 F.3d at 1007- 
OS. Yahoo! challenged the demand, explicitly basing its claims “on the Fourth 
Amendment rights of third-party customers.” Id. at 1008. The Foreign Intelligence 
Surveillance Court of Review permitted the challenge to proceed, finding no bar 
against “bring[ing] suit to enforce the rights of others,” notwithstanding that those 
rights arose under the Fourth Amendment. 10 Id. at 1009; see also, e.g., In re 
McVane, 44 F.3d 1127, 1137 (2d Cir. 1995) (analyzing Fourth Amendment 
challenge to grand-jury subpoena without questioning standing of respondents to 
invoke privacy rights of their family members). 

The DEA has sought to enforce a subpoena that both injures Jonas (as the 
State’s PDMP custodian forced to comply) and threatens to invade the Fourth 

10 As here, In re Directives involved a federal statute permitting the recipient of a 
government demand to contest its legality in court. Compare id. at 1009 (citing 50 
U.S.C. § 1805b(h)(l)(A)), with 21 U.S.C. § 876(c). Neither statute does anything 
“to circumscribe the types of claims of illegality that can be brought.” 551 F. 3d at 
1009. 
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Amendment privacy rights of individuals whose private medical information 
resides in the database, and whose privacy and confidentiality Jonas is statutorily 
charged with protecting, N.H. Rev. Stat. Ann. § 318-B:34(II), but who have no 
ability to challenge that impending harm. The Fourth Amendment arguments 
advanced by Jonas are properly before the Court. 

CONCLUSION 

Amici respectfully urge this Court to hold that the Fourth Amendment’s 
warrant requirement applies to the DEA’s requests for PDMP records in this case. 
In so holding, the Court need not disturb the general rule that “[t]he Government 
will be able to use subpoenas to acquire records in the overwhelming majority of 
investigations.” Carpenter, 138 S. Ct. at 2222. Because this is “the rare case where 
the suspect has a legitimate privacy interest in records held by a third party,” “a 
warrant is required.” Id. 
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ADDENDUM 

Table of Medical Conditions Treated by Schedule II-IV Medications 11 


Medical Condition 

Schedule II-IV Medications 
Approved for Treatment of Condition 

Hormone replacement therapy for 
treatment of gender identity 
disorder/gender dysphoria 

Testosterone 

Weight loss associated with AIDS 

Marinol (dronabinol), Cesamet 
(nabilone 

Nausea & vomiting in cancer patients 
undergoing chemotherapy 

Marinol (dronabinol), Cesamet 
(nabilone) 

Trauma- and stressor-related disorders, 
including acute stress disorder and post- 
traumatic stress disorder (PTSD) 

Xanax, Valium, Ativan, Lexotan, 
Librium, Traxene, Sepazon, Serax, 
Centrax, nordiazepam 

Anxiety disorders and other disorders 
with symptoms of panic 

Xanax, Valium, Ativan, Lexotan, 
Librium, Traxene, Sepazon, Serax, 
Centrax, nordiazepam 

Alcohol addiction withdrawal symptoms 

Serax/Serenid-D, Librium 
(chlordiazepoxide) 

Opiate addiction treatment 

Buprenorphine (Suboxone), methadone 

Attention deficit hyperactivity disorder 

Ritalin, Adderol, Vyvanse 

Obesity (weight loss drugs) 

Didrex, Voranil, Tenuate, mazindol 

Chronic or acute pain 

Narcotic painkillers, such as codeine 
(including Tylenol with codeine), 
hydrocodone, Demerol, morphine, 


11 Descriptions of listed medications, including their approved uses, are available 
through the Physicians’ Desk Reference website, www.pdr.net. A list of schedule 
I-V drugs is available at 

https://www.deadiversion.usdoj.gov/schedules/orangebook/e_cs_sched.pdf. See 
also Appellant’s App. 77 n.l (providing examples). While the New Hampshire 
PDMP tracks Schedule II-IV medications, N.H. Rev. Stat. Ann. § 318-B:33(III), 
some other PDMPs within the First Circuit also track Schedule V medications, thus 
expanding the amount of sensitive patient information retained. See Mass. Gen. 
Laws eh. 94C, § 24A; 216 R.I. Code R. § 20-20-3.4(A). 
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Vicodin, oxycodone (including 

Oxycontin and Percocet) 

Epilepsy and seizure disorders 

Nembutal (pentobarbital), Seconal 
(secobarbital), clobazam, clonazepam, 
Versed, Fycompa (perampanel) 

Testosterone deficiency in men 

Maxibolin, Orabolin, Durabolin, 
Duraboral (ethylestrenol) 

Delayed puberty in boys 

Anadroid-F, Halotestin, Ora-Testryl 

Narcolepsy 

Xyrem, Pro vigil 

Insomnia 

Ambien, Funesta, Sonata, Restoril, 
Halcion, Doral, Ativan, ProSom, 

Versed, Belsomra 

Migraines 

Butorphanol (Stadol) 
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